FAQ: IT Admin Guide

Minecraft Education is a game-based learning platform that offers educators a transformative way to engage students and ignite their passion for learning. The platform contains controls not found in the Consumer editions of Minecraft - which allow instructors oversight into the activities of their students. Educators in grades K-12 are using Minecraft Education to teach a range of subjects, from history and chemistry to sustainability and foreign languages, and can map lessons directly to specific learning outcomes and curriculum standards.  Through these project-based lessons, students build critical 21st century skills like collaboration, creative problem solving and digital citizenship.

Minecraft Education is built on a services-based architecture that requires communication from the application to external services on the internet. This architecture allows students to access new features such as Immersive Reader and new lesson content. In order to allow communication with these external services, your school network will need to allow traffic between Minecraft Education and a set of service endpoints. Allowing the following set of URLs will allow access to these services that are integrated into the application itself.

This is the list of all the URLs used by Minecraft Education.

Additional URLs for Microsoft auth & Azure services:

• Office 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn
  • See "Microsoft 365 Common and Office Online" section for URLs that relate to the Microsoft login services we use. IDs 56 and 59 in this section are the most relevant to what Minecraft Education uses. Please note however that different organizations may use different URLs. If your network may be blocking our services, you can compare the URLs you're blocking to the list above to see if the URLs are ours. 

You will also need to ensure the following processes can run while logging in:

• Minecraft.AdalServer.exe  (Login)

If you are using SSL Decryption on a Chromebook any url that serves up certificates would need to be added to your bypass list. The article from Google has information here.

The list of domains can change without notice, and some are CDNs which may be different regionally, so while we will attempt to keep this list up to date and complete, if possible we recommend you use the wildcards (*) above instead of managing specific sub-domains.

The Minecraft Education library uses the Microsoft owned services PlayFab and XForge to deliver library content and RTEP to gather error reports and logs. While we recommend allowing all xboxlive.com subdomains to help protect against future architecture changes such as additional authentication calls or the introduction of new CDNs, it is possible to limit the number of xboxlive.com services to just those currently used by XForge:

• https://xforge.xboxlive.com/
• https://xforgeassets001.xboxlive.com/
• https://xforgeassets002.xboxlive.com/

Minecraft Education only uses services from reputable sources that have been audited for compliance with all relevant security and privacy standards.  The communications between Minecraft Education and these service endpoints is limited to data sharing between the application and the service and the services we use are generally not available for web traffic.  

The xboxlive.com and playfabapi.com services connect Minecraft Education to our content hosting service which allows for much quicker access to our instructional content.  Opening your network to these URLs will allow authenticated communication to all Xbox services hosted on xboxlive.com but does not allow access to public websites like xbox.com. If you are concerned about exposing too many services from xboxlive.com, it is possible to only allow XForge by following the previous questions' instructions.

Minecraft Education uses a WebRTC signaling service to establish peer-to-peer connections between clients for multiplayer. The establishment of the multiplayer session occurs over web sockets and UDP ports and then the actual peer-to-peer connection occurs over ephemeral ports. Most networks should not need any configuration to support this multiplayer environment but if you do need to configure ports and firewalls, the following information should be helpful:

• The signaling connections use wss://signal.franchise.minecraft-services.net
• The STUN and TURN connections use turn.azure.com / world.relay.skype.com on the 20.202.0.0 / 16 IP range using remote TCP port 443 and remote UDP ports 3478-3481
• The peer-to-peer connections between host and joining client use local ephemeral UDP ports specified by the host client (the local port range is defined by the OS) and sent to the joining client via the signaling service

Visit these Help Center pages for information about installation:

• The Minecraft Education download page contains links to versions for each supported device. See OS specific guides below:
  
  • Windows Installation Guide
  • Chromebook Installation Guide
  • Mac Installation Guide
  • iPad Installation Guide
• Deploying and Updating Minecraft Education describes how to deploy the application manually or using system management software
  • You can deploy using Intune to Macs with the script located here.
• Use this link to get the Minecraft Education installer package

Minecraft Education uses Office 365 services for authentication, and does not collect or store any personal information within the application.  The Office 365 platform is in full compliance with COPPA, CIPA, and FERPA. View our User Privacy and Minecraft Education article for more information about. 

You can also visit the Microsoft Trust Center for more information about privacy and security in Microsoft applications.